1

I am working in wireshark and analyzing the traffic generated by a PC during web browsing. What filter should I use to know how many HTTP servers are contacted?
I mean, can I just filter the tcp.dstport==80 (or 443)?
Or should I filter the TCP SYN or http.request.method == GET? I have different results with those filters which one should I use?

2
  • Are you looking to count servers (separate IP addresses) or sessions (more than one connection to the same server)?
    – Ron Trunk
    Commented Jun 5, 2017 at 16:28
  • Servers separate IP addresses
    – Andrea
    Commented Jun 6, 2017 at 9:30

2 Answers 2

2

There are several ways to accomplish this, depending on what your ultimate goal is. If you simply want a list of server IP addresses, you can filter on your host address, then use the statistical tools in Wireshark. For example, after you capture the data, choose

Statistics/Endpoints

from the menu to see a list of hosts. You can also use

Statstics/Conversations

Either one should give you what you're looking for.

2
  • Ok thank you! So every IP I see there is a HTTP server? This is a report question and I think I haven't really understood what a HTTP server is...is it just a server contacted on port 80?
    – Andrea
    Commented Jun 6, 2017 at 13:42
  • It depends ;-) A http server is one that speaks the http protocol. That usually happens on port 80, but it isn't always the case. You could argue that https (port 443) is just encrypted http. The Conversations statistic lists the port numbers as well.
    – Ron Trunk
    Commented Jun 6, 2017 at 13:44
0

You can just type "http" word in the filter field in your wireshark program. Then hit enter. Wireshark will show every http sessions that were initiated by your web browser.

1
  • Yep but I need the http servers. A single server can have multiple session so Statstics/Conversations is probably better :)
    – Andrea
    Commented Jun 7, 2017 at 20:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.